Re: [tcpm] TCP Stealth - possible interest to the WG

[Hagen Paul Pfeifer <[e-mail]>]

Hi Richard, tcpm, tcpinc

the ground work for the ID is likely the following master thesis
titled "Improved Kernel-Based Port-Knocking in Linux"[1]:
Feeling a little bit unfortunate with this obfuscation technique but
highly appreciate efforts to prevent mass scanning. BTW: discussion on
this ID already started on perpass.

Cheers, Hagen

[1] https://gnunet.org/sites/default/files/ma_kirsch_2014.pdf


On 16 August 2014 01:51, Scheffenegger, Richard <[e-mail]> wrote:
> Hi,
>
> I just learned about an individual submission, which is probably of interest
> not only to the members of these two WGs;
>
> http://tools.ietf.org/html/draft-kirsch-ietf-tcp-stealth-00
>
>
> On a first, casual glance, I am wondering if the authors have realized all
> the implications of their suggestion;
>
> There seem to be at least two or three major issues that compromise either
> the working and stability of TCP, or work against the intended
> “stealthieness” of this modification (making it easy for an attacker to
> identify such sessions, provided he is able to actively interfere with
> segments in transit (ie. cause certain segments to be dropped).
>
> Nevertheless, it might be beneficial to discuss the generic idea in a wider
> forum, among brighter minds than me.
>
> Richard Scheffenegger
>
>
>
> _______________________________________________
> tcpm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tcpm
>